In present computer systems it is known to use hardware timers for resetting operating programs that may have become "hung up" or entered into an endless loop of operation. Such hardware timers are turned on at the initiation of a program cycle, whereby if the computer program does not complete all of the program steps and generate a reset signal for initiating another cycle of operation within a predetermined period of time, the hardware timer will timeout after the predetermined time and itself generate a reset of the computer controller for re-initiating another programmed cycle of operation. In this manner, if the program becomes "hung up", such as by continually repeating one step of the operation or program, for example, the hardware timer will provide a reset signal for permitting the program problem to be overcome. One problem with such hardware timers is that they must completely time themselves out, that is, measure the predetermined period of time before generating a reset signal. As a result, valuable computer time may be lost waiting for the reset signal to occur from a cycle of operation in which the program has gone into a fault condition. In certain applications the time delay may be life threatening, such as in a computer system used to operate a medical ventilator. Another problem with such hardware timers is that the timing period for the timer must be greater than the cycle time for a given program to complete all of the various steps associated with the program.
Other known systems may provide within the operating program itself certain marker information that occurs at selected points in the program cycle. If such a marker does not occur, the operating program detects the absence of the marker and may operate to call for a maintenance program to diagnose the system to determine whether any faults are occurring. This is accomplished in order to prevent premature resetting of the operating program by a watchdog hardware timer. Other known systems for providing a watchdog function are discussed below.
Sirazi et al. U.S. Pat. No. 4,586,179 (hereinafter Sirazi) teaches a microcomputer system that includes a watchdog timer circuit, for resetting the microcomputer in the event that a proper status signal is not applied to the watchdog timer at an appropriate time in a cycle of operation of the microcomputer. Failure of the system to provide the proper status signal is indicative of the microcomputer operating in an error mode such as caused by lockup or some other instability. Circuitry is also provided for detecting when the operating voltage falls below a predetermined level, for resetting the microcomputer at that time. Sirazi provides for automatic resetting and re-initialization of a microprocessor in the system upon the watchdog circuit detecting improper operation of the associated operating program, or upon the detection of excess or reduced operating voltages, as indicated. Until such time that the input power level reaches the proper operating level, the watchdog circuit provides a reset signal to the microprocessor. When the operating system or computer program is operating correctly, a series of timing pulses or a pulse stream are provided to the watchdog circuit. If these timing pulses are interrupted, the watchdog detects the same and resets the microprocessor.
Chu et al. U.S. Pat. No. 4,587,967 (hereinafter Chu) teaches a ventilator or respirator system including a microprocessed controller and a watchdog circuit. Chu monitors voltage levels to insure that a proper voltage is being supplied to the system for operating the ventilating equipment. In column 7, lines 47 through 50, it is indicated that "Reset watchdog step 158 is a safety step for triggering operation of the microprocessor if it has gone into a stop mode."
Chu et al. U.S. Pat. No. 4,617,637 (hereinafter Chu) teaches a respirator system that is similar to the system of Chu et al. U.S. Pat. No. 4,587,967 reviewed above. A watchdog function is discussed in column 8, lines 4 through 26.
Huang et al. U.S. Pat. No. 4,627,060 (hereinafter Wang) is entitled "Watchdog Timer". Specific circuitry and logic are taught in this reference for providing a watchdog timer function. The watchdog circuit includes means for providing a reset signal to a host system until such time that the watchdog system is operating correctly or properly powered up, whereafter the reset signal is terminated and the host system permitted to initiate operation. In column 6, lines 53 through 68, it is indicated that the watchdog timer can be used with either a programmable system of a host, or a hardwired system of a host. Also, the watchdog timer of Huang functions to periodically interrogate the host system, whereby the host system must respond by supplying an appropriate signal back to the watchdog circuit, in order to avoid the watchdog circuit's operating after a specific timed period to send a reset signal back to the host.
Elsworth et al. U.S. Pat. No. 4,708,831 (hereinafter Elsworth) describes a medical related apparatus for humidifying gases. As indicated in column 6, lines 61 through 63, a watchdog circuit 58 is included for checking the system. Note also in column 6 beginning on line 63 the software overview for "backup microprocessor", wherein the program steps are indicated, extending through columns 7 and 8. As shown, a watchdog timeout is included during the initialization process.
Yazawa U.S. Pat. No. 4,879,647 entitled "Watchdog Timer Circuit Suited For Use In Microcomputer", (hereinafter Yazawa) describes and illustrates a watchdog system capable of detecting a computer program "hangup" and/or premature termination of a program sequence. The watchdog circuit monitors computer programmed operation of the system by detecting the level of voltage across a capacitor at given times. When the programming for the system is operating properly, the program periodically executes a predetermined instruction for charging the sensing capacitor to a given voltage level, for maintaining the voltage across the capacitor above a predetermined level at all times that the program is operating correctly. In the event an error or "hangup" occurs in the program sequence, the predetermined instruction or program code will not be executed, whereby the voltage across the sensing capacitor will discharge within a predetermined time to below a predetermined level of voltage, which is sensed by the system for resetting the microprocessor to restart the operating program sequence.
Wendt U.S. Pat. No. 4,912,708 (hereinafter Wendt) teaches the use of a watchdog counter 16 in a digital network for automatically resetting a microcomputer system in the event of some fault occurring. As indicated in column 2, lines 38 through 45, "In order to reset the timer, a predetermined sequence of bytes must be written to the watchdog reset address. If the correct data is not written to the watchdog address, the watchdog timer will eventually timeout and cause a non-maskable interrupt or a system reset, thus allowing the program to recover automatically without manually forcing a reset." The watchdog system taught is a digital system that does not use any analog means for sensing errors in the program routine of the system. The system includes an 8-byte binary counter 12 for generating a sequence of pseudorandom byte patterns for preventing a watchdog counter 16 from timing out to interrupt the microprocessor. A comparator 14 compares the output of counter 12 with a data byte existing on data lines designated D0:D8 (a byte data line). If the two data bytes are identical the comparator acts to reset the watchdog counter 16, but if the bytes are not equal, the watchdog counter 16 is allowed to timeout for resetting the microprocessor.
Hartman U.S. Pat. No. 4,982,404 (hereinafter Hartman) describes a microprocessor system including a watchdog timer for maintaining proper program sequence operation. Hartman teaches a system that includes a main counter, a watchdog timer, and a delay counter. Upon initiation of operation of the microprocessor system, the main counter is periodically decremented as the main program steps through its operating sequence. At a given time in the sequencing, the main timer will begin incrementing the delay timer. During proper operation of the program sequence, the watchdog timer is periodically reset. When the main counter reaches a zero count, the microprocessor is reset for restarting the main program. If the main counter fails to restart the main program, the watchdog timer times itself out, and operates to provide a reset signal to the microprocessor for accomplishing the reset. However, if the watchdog timer fails, the delay counter (which upon completion of the main system program was placed into a stepwise incrementing count) will act to provide a reset of the microprocessor in the event both the main program and the watchdog timer fail to accomplish such a reset. In this manner, the system provides backup subsystems for resetting the microprocessor in the event of errors in the program routine concurrent with a failure of the hardware watchdog timer, preventing it from resetting the microprocessor.